Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
585 results · page 8 of 12
May 3, 2024There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the servicCVE-2024-33398 · Other software · piraeus_operator · reported by MITREHigh 7.5
There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster.
- Product
- piraeus_operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 30, 2024An information disclosure flaw was found in OpenShift's internal image registry operator.CVE-2024-4369 · Other software · Red Hat · reported by Red HatMedium 6.8
An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURE_CLIENT_SECRET can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions to obtain pod information from the openshift-image-registry namespace could use this obtained client secret to perform actions as the registry operator's Azure service account.
- Product
- Red Hat OpenShift Container Platform 4.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 25, 2024A credentials leak vulnerability was found in the cluster monitoring operator in OCP.CVE-2024-1139 · Other software · Red Hat · reported by Red HatHigh 7.7
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
- Product
- Red Hat OpenShift Container Platform 4.12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 16, 2024The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment.CVE-2024-3862 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. This vulnerability affects Firefox < 125.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 12, 2024Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator.CVE-2024-31391 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for accessing Solr: including the "solr" and "admin" accounts for use by end-users, and a "k8s-oper" account which the operator uses for its own requests to Solr. One common source of these operator requests is healthchecks: liveness, readiness, and startup probes are all used to determine Solr's health and ability to receive traffic. By default, the operator configures the Solr APIs used for these probes to be exempt from authentication, but users may specifically request that authentication be required on probe endpoints as well. Whenever one of these probes would fail, if authentication was in use, the Solr Operator would create a Kubernetes "event" containing the username and password of the "k8s-oper" account. Within the affected version range, this vulnerability affects any solrcloud resource which (1) bootstrapped security through use of the `.solrOptions.security.authenticationType=bas
- Product
- Apache Solr Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Mar 3, 2024IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker thCVE-2024-27255 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 283905.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 3, 2024IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or tranCVE-2023-47745 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command. IBM X-Force ID: 272638.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 26, 2024Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack CVE-2024-1890 · Other software · SMA · reported by cve-coordination@incibe.esMedium 6.4
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.
- Product
- Sunny Webbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie.CVE-2023-28025 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 18, 2023A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in theCVE-2023-5056 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
- Product
- Service Interconnect 1 for RHEL 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 4, 2023Memory corruption while using the UIM diag command to get the operators name.CVE-2023-33018 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while using the UIM diag command to get the operators name.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Nov 24, 2023capsule-proxy is a reverse proxy for the capsule operator project.CVE-2023-48312 · Other software · projectcapsule · reported by GitHubCritical 9.8
capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.
- Product
- capsule-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUGCVE-2023-0436 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.5
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration: DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )
- Product
- MongoDB Atlas Kubernetes Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.CVE-2023-45510 · Other software · Justdan96 · reported by MITREHigh 7.5
tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.
- Product
- Tsmuxer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in CVE-2023-3775 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.2
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.
- Product
- Vault Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Sep 27, 2023A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log.CVE-2023-4065 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
- Product
- RHEL-8 based Middleware Containers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 12, 2023 An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sCVE-2023-21521 · Other software · BlackBerry · reported by secure@blackberry.comHigh 7.2
An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
- Product
- AtHoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.comsupport.blackberry.com
Sep 1, 2023Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4720 · Other software · gpac · reported by security@huntr.devMedium 5.5
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023 A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.CVE-2023-21407 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.8
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
- Product
- AXIS License Plate Verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields.CVE-2023-23568 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 4.3
Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jul 24, 2023 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.CVE-2023-25074 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 7.1
Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jul 24, 2023 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage.CVE-2023-22428 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 7.6
Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831(MR8), vEL8.40 and prior.
- Product
- Command Centre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Jun 23, 2023A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-23344 · Other software · HCL Software · reported by psirt@hcl.comLow 3
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
- Product
- HCL BigFix WebUI Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 14, 2023 A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious userCVE-2023-1049 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.
- Product
- EcoStruxure™ Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Apr 26, 2023Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes.CVE-2023-30841 · Other software · metal3-io · reported by GitHubMedium 6
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
- Product
- baremetal-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, anCVE-2023-22913 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.1
A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.
- Product
- USG FLEX series firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023The OpenFeature Operator allows users to expose feature flags to applications.CVE-2023-29018 · Other software · open-feature · reported by GitHubHigh 8
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.
- Product
- open-feature-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server.CVE-2023-30637 · Other software · Baidu · reported by MITREHigh 7.5
Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server. NOTE: installations with brpc-0.14.0 and later are unaffected.
- Product
- Braft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.CVE-2023-27117 · Other software · Webassembly · reported by MITREHigh 7.8
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters.CVE-2023-22480 · Other software · KubeOperator · reported by GitHubHigh 7.3
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
- Product
- KubeOperator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023KubePi is a modern Kubernetes panel.CVE-2023-22478 · Other software · KubeOperator · reported by GitHubHigh 7.3
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
- Product
- KubePi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023KubePi is a modern Kubernetes panel.CVE-2023-22479 · Other software · KubeOperator · reported by GitHubHigh 7.5
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
- Product
- KubePi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023KubePi is a k8s panel.CVE-2023-22463 · Other software · KubeOperator · reported by GitHubCritical 9.8
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.
- Product
- KubePi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text.CVE-2022-38658 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.7
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
- Product
- BigFix Server Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 21, 2022BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES SuCVE-2022-38655 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
- Product
- BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2022-38659 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 5, 2022A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary admCVE-2022-43553 · Other software · UI · reported by support@hackerone.comHigh 8.8
A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.
- Product
- Edgemax Edgerouter Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Dec 5, 2022Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.CVE-2022-4293 · Other software · vim · reported by security@huntr.devMedium 5.5
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022Clerk: Is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site optionsCVE-2022-3907 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
- Product
- Clerk
- Fixed in
- 4.0.0
- What to do
- Update Clerk to 4.0.0 or newer.
Nov 4, 2022A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileCVE-2022-41671 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversarieCVE-2022-41670 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges CVE-2022-41669 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlCVE-2022-41668 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privilegesCVE-2022-41667 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL whicCVE-2022-41666 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
- Product
- EcoStruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022WP 2FA: Uses comparison operators that don't mitigate time-based attacksCVE-2022-2891 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
- Product
- WP 2FA
- Fixed in
- 2.3.0
- What to do
- Update WP 2FA to 2.3.0 or newer.
Sep 30, 2022Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-mCVE-2022-32540 · Other software · Bosch · reported by psirt@bosch.comMedium 5.9
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
- Product
- BVMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Sep 28, 2022When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, aCVE-2022-3287 · Other software · Fwupd · reported by Red HatMedium 6.5
When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
- Product
- Fwupd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2022Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in tCVE-2022-39135 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
- Product
- Apache Calcite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 7, 2022Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to deCVE-2022-36049 · Other software · fluxcd · reported by GitHubHigh 7.7
Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.
- Product
- flux2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.